AIKIDO-2026-69639

TL;DR

During server-side rendering, Angular's serializer escapes the > character inside ProcessingInstruction content but does not check for or escape matching closing tags of ancestor fallback elements such as noscript, iframe, noembed, or noframes. A crafted processing instruction created via createProcessingInstruction() or Renderer2 can prematurely close the fallback container, letting sibling markup execute as live HTML in the browser instead of remaining inert. The fix checks the ancestor fallback tags and escapes any matching closing sequence inside the processing instruction content.